If you bought a Copilot+ PC so you could run image generation on the NPU and keep your prompts off Microsoft’s servers, the privacy pitch just took a hit. Reverse engineer Xusheng Li published a write-up on 20 August 2026 showing that Microsoft Paint’s Cocreator and the Photos app’s Image Creator and Restyle Image do not generate the watermark locally. They send the prompt, style, and a lastPromptGenerationId to a Microsoft moderation endpoint, get a watermarkId GUID back, and then write that GUID into the image’s pixels - and into the file’s C2PA manifest - before you ever see the file (xusheng.dev: Microsoft Paint and Photos Embed Server-Issued GUIDs as Invisible Watermarks in Locally-Generated Images).
Microsoft discloses remote content filtering and C2PA Content Credentials. It does not disclose that a prompt-associated GUID is being written into the image itself.
The “local” path is not offline
The NPU on a Copilot+ PC really does run the diffusion model on-device. Li’s static analysis of Paint’s bundled AI files (seg.onnxe at 23.1 MB, inseg_enc.onnxe at 28.0 MB, inseg_dec.onnxe at 16.5 MB, and mager.onnxe at 302.4 MB) confirms the model weights ship with the app. Image synthesis happens locally. Prompt moderation does not (xusheng.dev).
Paint calls a Microsoft moderation endpoint hosted on Azure Front Door (apsaiservices-a0fqcjc6bzbhgdcd.b02.azurefd.net, path /v1/paint-cocreator/moderate-prompt) with the prompt, style, and lastPromptGenerationId. The server returns a revisedPrompt, a new promptGenerationId, and - the part that matters for this story - a watermarkId GUID. The same GUID then shows up in the C2PA soft-binding assertion for the saved file, so the manifest and the pixel watermark share one identifier and can be cross-referenced.
Li put it bluntly: "generated locally" does not mean that the complete operation is local, and "local" does not mean offline (xusheng.dev). On a 512x512 test image, 193,376 of 262,144 pixels were modified by the watermarking step alone.
How the watermark gets in
The watermark is written by a 1.67 MB DLL called Watermarker.dll, with the wrapper signature WmkWriteWatermark(output_pixels, payload, payload_length, width, height, stride, input_pixels, pixel_format). The payload must be exactly 16 bytes. Li’s reverse engineering shows the actual message is 18 bytes - a leading 0x4c byte, the 16-byte GUID, and a checksum byte that is the sum of the GUID’s 16 bytes modulo 256 (xusheng.dev).
The embedding uses 3-by-5 matrix operations and a matrix-decomposition routine with constants 24.0, 0.25, 0.5, and 0.2. Li describes it as a “content-adaptive, block-domain, SVD-style” scheme. Width and height must be at least 192 pixels; the routine rounds usable dimensions down to 8-pixel boundaries; and each of the 144 message bits has to be placed at least three times, or the routine returns -8 and treats the generation as failed.
The same DLL is present in the Photos app, where it is called by PerformSDTextToImageAndWatermarkAsync (Image Creator) and PerformSDSketchToImageAndWatermarkAsync (Restyle Image), both routing through ApplyWatermark. In Paint, a watermark failure fails the whole generation. In Photos, a failure is logged but the image is still returned (xusheng.dev).
The watermark scheme itself is Microsoft Research’s InvisMark, published in November 2024 and accepted to WACV 2025. The paper claims PSNR of about 51 dB and SSIM of about 0.998 - imperceptible to the eye - and bit accuracy above 97% across common image manipulations (arXiv 2411.07795: InvisMark).
What Microsoft discloses - and what it does not
Microsoft’s own documentation tells Paint users that "we apply content filtering to prevent the generation of images" and that the saved file "will contain C2PA manifest helping users identify that it is an AI generated image". Those are the only two disclosures Li found (xusheng.dev).
Three things are not disclosed:
- The C2PA manifest includes a soft-binding assertion whose value is the same GUID that moderation issued for the prompt.
- That GUID is also written into the image’s pixels by
Watermarker.dll. - Successive prompts are linkable through
lastPromptGenerationId, so the same user’s session is correlatable across saves.
The soft-binding assertion uses algorithm com.microsoft.invismark.1, with the c2pa.watermarked action and the Microsoft Responsible AI Provenance generator. In a real saved PNG, the caBX C2PA chunk sits immediately after IHDR and weighs 18,979 bytes (xusheng.dev).
AI-generated saves are also restricted to PNG, JPEG, GIF, and the proprietary .paint format. BMP is missing because C2PA cannot embed manifests in it. Li notes that "cannot embed arbitrary manifest data without using an external manifest" is the reason (xusheng.dev).
Microsoft did not respond to Li before publication. He also observed that "It also appears possible to modify Paint or Photos to bypass both prompt moderation and watermarking" - a separate concern that the DLL-and-endpoint design is easy to tamper with on a local machine.
What This Means
The hard rule for privacy readers is the same as it has been since Windows 11 began shipping cloud-routed Copilot features by default: “on-device” is not the same as “private”. The diffusion model runs on the NPU, but every prompt still leaves the machine for moderation, and the response is a stable identifier that ends up baked into both the pixels and the metadata. Anyone who can read the PNG can recover the GUID, and anyone with the GUID can correlate prompts from the same session through lastPromptGenerationId.
This also changes the calculus for “local AI” advocates. The draw of a Copilot+ PC was supposed to be inference without a cloud round-trip. Cocreator does the inference locally. It does not keep the prompt, the moderation result, or the watermark identifier local. If you wanted to keep your prompts off Microsoft’s servers for IP, journalistic, or legal reasons, you cannot get there through Paint or Photos as shipped.
For readers who were already skeptical of C2PA, the finding adds a second layer. The signed manifest does not just say “this image is AI-generated.” It includes a soft-binding value that any C2PA-aware tool can read, and that value is the same number that lives in the pixels. The watermark is not invisible in the cryptographic sense; it is invisible to humans, and it survives common image manipulations because that is what the underlying InvisMark scheme is designed for (arXiv 2411.07795).
The Bottom Line
Microsoft Paint’s Cocreator and the Photos app’s Image Creator and Restyle Image embed a server-issued GUID into both the pixels and the C2PA manifest of every locally generated AI image. Microsoft discloses remote moderation and Content Credentials. It does not disclose that the prompt, the moderation GUID, and the watermark are linked. If you wanted “local” to mean “offline”, that is not the system Microsoft is shipping.